@ratelkey/burrow-sdk 0.1.0

package/dist/esm/BurrowClient.d.ts

@@ -0,0 +1,40 @@
+import type { KeyObject } from "node:crypto";
+import { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
+import type { TlsMode } from "./Tls.js";
+/**
+ * Reads secrets from a Burrow as a machine identity. Every call is independently Ed25519-signed — there is
+ * no session and no long-lived bearer token. Instances are reusable; construct one via `Burrow`.
+ */
+export interface BurrowClient {
+    /** The Burrow this client reads from. */
+    readonly burrowUrl: string;
+    /** The machine identity this client acts as. */
+    readonly machineId: string;
+    /**
+     * Read a secret by its `project/env/NAME` coordinate, whole, in one signed call. Project the result
+     * locally with `Secret.value`, `Secret.toMap()`, `Secret.getField()`, or `Secret.getFields()` — the
+     * projections don't re-fetch.
+     */
+    getSecret(coordinate: string): Promise<Secret>;
+    /** Every secret coordinate this machine can read, resolved server-side. */
+    listSecrets(): Promise<SecretCoordinate[]>;
+    /** Every project this machine can read, and the environment categories it holds in each. */
+    listProjects(): Promise<ProjectAccess[]>;
+}
+/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+export declare class DefaultBurrowClient implements BurrowClient {
+    readonly burrowUrl: string;
+    readonly machineId: string;
+    private readonly key;
+    private readonly clientTag;
+    private readonly now;
+    private readonly transport;
+    constructor(burrowUrl: string, machineId: string, key: KeyObject, clientTag: string, tls: TlsMode, 
+    /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
+    pinStoreDir: string | null, now?: () => number);
+    getSecret(coordinate: string): Promise<Secret>;
+    listSecrets(): Promise<SecretCoordinate[]>;
+    listProjects(): Promise<ProjectAccess[]>;
+    private signedGet;
+}
+//# sourceMappingURL=BurrowClient.d.ts.map

package/dist/esm/BurrowClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BurrowClient.d.ts","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGxC;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3C,4FAA4F;IAC5F,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC1C;AAED,8GAA8G;AAC9G,qBAAa,mBAAoB,YAAW,YAAY;IAIpD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAI1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAG3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACT,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EAClC,GAAG,EAAE,OAAO;IACZ,wGAAwG;IACxG,WAAW,EAAE,MAAM,GAAG,IAAI,EACT,GAAG,GAAE,MAAM,MAAiB;IAKzC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9C,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQ1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAe9C,OAAO,CAAC,SAAS;CAWlB"}

package/dist/esm/BurrowClient.js

@@ -0,0 +1,106 @@
+import { BurrowTransportException } from "./Errors.js";
+import { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
+import { MachineSigner } from "./Signer.js";
+import { Transport } from "./Transport.js";
+/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+export class DefaultBurrowClient {
+    burrowUrl;
+    machineId;
+    key;
+    clientTag;
+    now;
+    transport;
+    constructor(burrowUrl, machineId, key, clientTag, tls, 
+    /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
+    pinStoreDir, now = Date.now) {
+        this.burrowUrl = burrowUrl;
+        this.machineId = machineId;
+        this.key = key;
+        this.clientTag = clientTag;
+        this.now = now;
+        this.transport = new Transport(burrowUrl, tls, pinStoreDir);
+    }
+    async getSecret(coordinate) {
+        const c = SecretCoordinate.parse(coordinate);
+        if (c.project.length === 0 || c.environment.length === 0 || c.name.length === 0) {
+            throw new TypeError(`secret coordinate must be 'project/environment/NAME', got '${coordinate}'`);
+        }
+        const body = await this.signedGet("secret.read", [c.project, c.environment, c.name], `/v1/machine/secrets/${encode(c.project)}/${encode(c.environment)}/${encode(c.name)}`);
+        return parseSecret(body);
+    }
+    async listSecrets() {
+        const body = await this.signedGet("secrets.list", [], "/v1/machine/secrets");
+        const dto = decode(body);
+        const secrets = dto["secrets"];
+        if (!Array.isArray(secrets))
+            return [];
+        return secrets.filter((s) => typeof s === "string").map((s) => SecretCoordinate.parse(s));
+    }
+    async listProjects() {
+        const body = await this.signedGet("projects.list", [], "/v1/machine/projects");
+        const dto = decode(body);
+        const projects = dto["projects"];
+        if (!Array.isArray(projects))
+            return [];
+        return projects.map((p) => {
+            const o = (p ?? {});
+            const categories = o["categories"];
+            return new ProjectAccess(typeof o["project"] === "string" ? o["project"] : "", Array.isArray(categories) ? categories.filter((c) => typeof c === "string") : []);
+        });
+    }
+    signedGet(action, resource, path) {
+        const headers = MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now());
+        return this.transport.get(path, headers);
+    }
+}
+/**
+ * The read response. `value`/`version` are present for a single value, `fields` for a whole structured
+ * secret. Mirrors the Burrow's MachineSecretView / MachineStructuredView; unknown keys are ignored.
+ */
+function parseSecret(body) {
+    const dto = decode(body);
+    const name = typeof dto["name"] === "string" ? dto["name"] : "";
+    const rawFields = dto["fields"];
+    if (Array.isArray(rawFields)) {
+        const fields = new Map();
+        for (const raw of rawFields) {
+            const f = (raw ?? {});
+            const fieldName = typeof f["name"] === "string" ? f["name"] : "";
+            fields.set(fieldName, {
+                name: fieldName,
+                value: typeof f["value"] === "string" ? f["value"] : "",
+                type: typeof f["type"] === "string" ? f["type"] : "",
+            });
+        }
+        return Secret.structured(name, fields);
+    }
+    return Secret.single(name, typeof dto["value"] === "string" ? dto["value"] : "", typeof dto["type"] === "string" ? dto["type"] : "", typeof dto["version"] === "number" ? dto["version"] : 0);
+}
+function decode(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch (e) {
+        throw new BurrowTransportException(`decoding burrow response: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new BurrowTransportException("decoding burrow response: expected a JSON object");
+    }
+    return parsed;
+}
+/**
+ * Percent-encode one URL path segment (RFC 3986 unreserved set), so a coordinate reaches the Burrow intact
+ * and decodes back to the exact value the signature covers. `encodeURIComponent` leaves `!'()*` unescaped,
+ * which is why this is spelled out.
+ */
+function encode(s) {
+    let out = "";
+    for (const b of Buffer.from(s, "utf8")) {
+        const ch = String.fromCharCode(b);
+        out += UNRESERVED.test(ch) ? ch : `%${b.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+    return out;
+}
+const UNRESERVED = /^[A-Za-z0-9\-._~]$/;
+//# sourceMappingURL=BurrowClient.js.map

package/dist/esm/BurrowClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA2B3C,8GAA8G;AAC9G,MAAM,OAAO,mBAAmB;IAInB;IACA;IACQ;IACA;IAIA;IAVF,SAAS,CAAY;IAEtC,YACW,SAAiB,EACjB,SAAiB,EACT,GAAc,EACd,SAAiB,EAClC,GAAY;IACZ,wGAAwG;IACxG,WAA0B,EACT,MAAoB,IAAI,CAAC,GAAG;QAPpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QAIjB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,aAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EACR,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}

package/dist/esm/Errors.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Base type for every error the SDK raises. Catch this to handle any Burrow failure uniformly.
+ *
+ * The names mirror the Kotlin SDK's exception hierarchy one-for-one, so a failure means the same thing and
+ * is documented the same way in every language we ship.
+ */
+export declare class BurrowException extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The Burrow rejected the signed request (HTTP 401). Every authentication failure collapses to one reason:
+ * an unknown or disabled machine, a bad signature, a replayed nonce, or a clock skew past the freshness
+ * window. The message is the Burrow's own verbatim reason.
+ */
+export declare class BurrowAuthException extends BurrowException {
+}
+/** The machine authenticated but holds no grant for the requested project/environment (HTTP 403). */
+export declare class BurrowForbiddenException extends BurrowException {
+}
+/** The requested project, environment, secret, or field does not exist (HTTP 404). */
+export declare class BurrowNotFoundException extends BurrowException {
+}
+/** The Burrow failed to serve the request (HTTP 5xx) — e.g. server-side decryption failed. */
+export declare class BurrowServerException extends BurrowException {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/**
+ * The Burrow's TLS certificate did not match the pinned one. Either the Burrow's certificate was re-issued
+ * (remove its entry from the pin store and retry) or the connection is being intercepted.
+ */
+export declare class BurrowCertificateException extends BurrowException {
+}
+/** The Burrow could not be reached, or its response could not be parsed. */
+export declare class BurrowTransportException extends BurrowException {
+}
+/**
+ * The machine identity could not be resolved or loaded: no identity on this host, an ambiguous selector, a
+ * missing or invalid private key, or a malformed identity file.
+ */
+export declare class BurrowIdentityException extends BurrowException {
+}
+/**
+ * A projection didn't match the secret's shape — `Secret.value` on a structured secret, or
+ * `Secret.toMap()` / `Secret.getField()` / `Secret.getFields()` on a single-value one.
+ */
+export declare class SecretShapeException extends BurrowException {
+}
+/** A requested field is not present in a structured secret. */
+export declare class FieldNotFoundException extends BurrowException {
+    readonly secret: string;
+    readonly field: string;
+    constructor(secret: string, field: string, available: Iterable<string>);
+}
+//# sourceMappingURL=Errors.d.ts.map

package/dist/esm/Errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.d.ts","sourceRoot":"","sources":["../../src/Errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM3D;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,eAAe;CAAG;AAE3D,qGAAqG;AACrG,qBAAa,wBAAyB,SAAQ,eAAe;CAAG;AAEhE,sFAAsF;AACtF,qBAAa,uBAAwB,SAAQ,eAAe;CAAG;AAE/D,8FAA8F;AAC9F,qBAAa,qBAAsB,SAAQ,eAAe;IAEtD,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,eAAe;CAAG;AAElE,4EAA4E;AAC5E,qBAAa,wBAAyB,SAAQ,eAAe;CAAG;AAEhE;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;CAAG;AAE/D;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;CAAG;AAE5D,+DAA+D;AAC/D,qBAAa,sBAAuB,SAAQ,eAAe;IAEvD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBADb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACtB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;CAI9B"}

package/dist/esm/Errors.js

@@ -0,0 +1,67 @@
+/**
+ * Base type for every error the SDK raises. Catch this to handle any Burrow failure uniformly.
+ *
+ * The names mirror the Kotlin SDK's exception hierarchy one-for-one, so a failure means the same thing and
+ * is documented the same way in every language we ship.
+ */
+export class BurrowException extends Error {
+    constructor(message, options) {
+        super(message, options);
+        // `new.target` is the concrete subclass, so every error reports its own name without each subclass
+        // having to restate it.
+        this.name = new.target.name;
+    }
+}
+/**
+ * The Burrow rejected the signed request (HTTP 401). Every authentication failure collapses to one reason:
+ * an unknown or disabled machine, a bad signature, a replayed nonce, or a clock skew past the freshness
+ * window. The message is the Burrow's own verbatim reason.
+ */
+export class BurrowAuthException extends BurrowException {
+}
+/** The machine authenticated but holds no grant for the requested project/environment (HTTP 403). */
+export class BurrowForbiddenException extends BurrowException {
+}
+/** The requested project, environment, secret, or field does not exist (HTTP 404). */
+export class BurrowNotFoundException extends BurrowException {
+}
+/** The Burrow failed to serve the request (HTTP 5xx) — e.g. server-side decryption failed. */
+export class BurrowServerException extends BurrowException {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/**
+ * The Burrow's TLS certificate did not match the pinned one. Either the Burrow's certificate was re-issued
+ * (remove its entry from the pin store and retry) or the connection is being intercepted.
+ */
+export class BurrowCertificateException extends BurrowException {
+}
+/** The Burrow could not be reached, or its response could not be parsed. */
+export class BurrowTransportException extends BurrowException {
+}
+/**
+ * The machine identity could not be resolved or loaded: no identity on this host, an ambiguous selector, a
+ * missing or invalid private key, or a malformed identity file.
+ */
+export class BurrowIdentityException extends BurrowException {
+}
+/**
+ * A projection didn't match the secret's shape — `Secret.value` on a structured secret, or
+ * `Secret.toMap()` / `Secret.getField()` / `Secret.getFields()` on a single-value one.
+ */
+export class SecretShapeException extends BurrowException {
+}
+/** A requested field is not present in a structured secret. */
+export class FieldNotFoundException extends BurrowException {
+    secret;
+    field;
+    constructor(secret, field, available) {
+        super(`no field '${field}' in '${secret}' (has: ${[...available].sort().join(", ")})`);
+        this.secret = secret;
+        this.field = field;
+    }
+}
+//# sourceMappingURL=Errors.js.map

package/dist/esm/Errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.js","sourceRoot":"","sources":["../../src/Errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,mGAAmG;QACnG,wBAAwB;QACxB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,eAAe;CAAG;AAE3D,qGAAqG;AACrG,MAAM,OAAO,wBAAyB,SAAQ,eAAe;CAAG;AAEhE,sFAAsF;AACtF,MAAM,OAAO,uBAAwB,SAAQ,eAAe;CAAG;AAE/D,8FAA8F;AAC9F,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAE7C;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,eAAe;CAAG;AAElE,4EAA4E;AAC5E,MAAM,OAAO,wBAAyB,SAAQ,eAAe;CAAG;AAEhE;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,eAAe;CAAG;AAE/D;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;CAAG;AAE5D,+DAA+D;AAC/D,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAE9C;IACA;IAFX,YACW,MAAc,EACd,KAAa,EACtB,SAA2B;QAE3B,KAAK,CAAC,aAAa,KAAK,SAAS,MAAM,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAJ9E,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;IAIxB,CAAC;CACF"}

package/dist/esm/Identity.d.ts

@@ -0,0 +1,62 @@
+import { type KeyObject } from "node:crypto";
+/**
+ * A machine identity for one Burrow — the record the `curl | sh` bootstrap writes to
+ * `~/.burrow/burrows/<slug>/identity.json`, plus a reference to the Ed25519 private key it generated. One
+ * identity per Burrow; a client acts as exactly one of them.
+ *
+ * The private key never leaves the machine: it stays in the referenced PEM file and only signs requests.
+ */
+export declare class MachineIdentity {
+    readonly burrowUrl: string;
+    readonly machineId: string;
+    readonly privateKeyPath: string;
+    readonly slug: string;
+    readonly burrowName: string;
+    readonly name: string;
+    constructor(burrowUrl: string, machineId: string, privateKeyPath: string, slug?: string, burrowName?: string, name?: string);
+    /** The Burrow's shown label, falling back to slug, then the URL host. */
+    get label(): string;
+    /**
+     * The directory this identity lives in — `<home>/burrows/<slug>/`, where its pinned key sits beside it.
+     *
+     * Derived from `privateKeyPath` rather than recorded, because identity.json does not carry it: the
+     * bootstrap writes the key as `<dir>/identity.pem`, so the parent IS the directory.
+     *
+     * @internal
+     */
+    get directory(): string;
+    /** @internal */
+    matches(selector: string): boolean;
+    /** Load and parse the Ed25519 private key (PKCS#8 PEM) this identity references. */
+    loadPrivateKey(): KeyObject;
+    /**
+     * Read one identity record. The three fields the bootstrap always writes are required; the rest are
+     * display metadata that a hand-written file may omit.
+     */
+    /** @internal */
+    static fromJson(raw: unknown): MachineIdentity;
+}
+/** Discovers and resolves the machine identities the bootstrap writes under `~/.burrow`. */
+export declare const Identities: {
+    /** The identity root: `$BURROW_HOME` if set, else `~/.burrow`. */
+    home(): string;
+    /**
+     * Every identity under `<home>/burrows/<slug>/identity.json`, sorted by label then machine id.
+     * Directories without a readable, well-formed identity.json are skipped.
+     */
+    discover(home?: string): MachineIdentity[];
+    /**
+     * Resolve the identity a client should act as. A single identity on file resolves automatically; with
+     * several, `selector` (a burrow name, slug, machine id, or URL) must disambiguate.
+     */
+    resolve(selector?: string | null, home?: string): MachineIdentity;
+    /**
+     * Resolve `target` to an identity for `Burrow`: null/undefined → the single identity (`resolve`); a
+     * filesystem path (a burrow directory or an identity.json) → load it directly; anything else → a selector
+     * (`resolve`). A URL (contains `://`) is always treated as a selector, never a path.
+     */
+    select(target?: string | null, home?: string): MachineIdentity;
+};
+/** Parse an Ed25519 private key from a PKCS#8 PEM string (what `openssl genpkey -algorithm ed25519` writes). */
+export declare function parseEd25519PrivateKey(pem: string, source: string): KeyObject;
+//# sourceMappingURL=Identity.d.ts.map

package/dist/esm/Identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.d.ts","sourceRoot":"","sources":["../../src/Identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAM/D;;;;;;GAMG;AACH,qBAAa,eAAe;IAExB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM;gBALZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,MAAW,EACjB,UAAU,GAAE,MAAW,EACvB,IAAI,GAAE,MAAW;IAG5B,yEAAyE;IACzE,IAAI,KAAK,IAAI,MAAM,CAIlB;IAED;;;;;;;OAOG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,gBAAgB;IAChB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAWlC,oFAAoF;IACpF,cAAc,IAAI,SAAS;IAa3B;;;OAGG;IACH,gBAAgB;IAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe;CAc/C;AAED,4FAA4F;AAC5F,eAAO,MAAM,UAAU;IACrB,kEAAkE;YAC1D,MAAM;IAMd;;;OAGG;oBACY,MAAM,GAAuB,eAAe,EAAE;IAyB7D;;;OAGG;uBACgB,MAAM,GAAG,IAAI,SAAQ,MAAM,GAAuB,eAAe;IA6BpF;;;;OAIG;oBACa,MAAM,GAAG,IAAI,SAAQ,MAAM,GAAuB,eAAe;CAOlF,CAAC;AAEF,gHAAgH;AAChH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAmB7E"}

package/dist/esm/Identity.js

@@ -0,0 +1,269 @@
+import { createPrivateKey } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+import { BurrowIdentityException } from "./Errors.js";
+/**
+ * A machine identity for one Burrow — the record the `curl | sh` bootstrap writes to
+ * `~/.burrow/burrows/<slug>/identity.json`, plus a reference to the Ed25519 private key it generated. One
+ * identity per Burrow; a client acts as exactly one of them.
+ *
+ * The private key never leaves the machine: it stays in the referenced PEM file and only signs requests.
+ */
+export class MachineIdentity {
+    burrowUrl;
+    machineId;
+    privateKeyPath;
+    slug;
+    burrowName;
+    name;
+    constructor(burrowUrl, machineId, privateKeyPath, slug = "", burrowName = "", name = "") {
+        this.burrowUrl = burrowUrl;
+        this.machineId = machineId;
+        this.privateKeyPath = privateKeyPath;
+        this.slug = slug;
+        this.burrowName = burrowName;
+        this.name = name;
+    }
+    /** The Burrow's shown label, falling back to slug, then the URL host. */
+    get label() {
+        return (blankTo(this.burrowName, blankTo(this.slug, blankTo(hostOf(this.burrowUrl), "(unnamed burrow)"))));
+    }
+    /**
+     * The directory this identity lives in — `<home>/burrows/<slug>/`, where its pinned key sits beside it.
+     *
+     * Derived from `privateKeyPath` rather than recorded, because identity.json does not carry it: the
+     * bootstrap writes the key as `<dir>/identity.pem`, so the parent IS the directory.
+     *
+     * @internal
+     */
+    get directory() {
+        return dirname(this.privateKeyPath);
+    }
+    /** @internal */
+    matches(selector) {
+        const s = selector.trim();
+        return (eq(s, this.burrowName) ||
+            eq(s, this.slug) ||
+            eq(s, this.machineId) ||
+            eq(s, this.burrowUrl) ||
+            eq(s, this.label));
+    }
+    /** Load and parse the Ed25519 private key (PKCS#8 PEM) this identity references. */
+    loadPrivateKey() {
+        let pem;
+        try {
+            pem = readFileSync(this.privateKeyPath, "utf8");
+        }
+        catch (e) {
+            throw new BurrowIdentityException(`reading private key ${this.privateKeyPath}: ${messageOf(e)}`, { cause: e });
+        }
+        return parseEd25519PrivateKey(pem, this.privateKeyPath);
+    }
+    /**
+     * Read one identity record. The three fields the bootstrap always writes are required; the rest are
+     * display metadata that a hand-written file may omit.
+     */
+    /** @internal */
+    static fromJson(raw) {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            throw new BurrowIdentityException("identity is not a JSON object");
+        }
+        const o = raw;
+        return new MachineIdentity(required(o, "burrowUrl"), required(o, "machineId"), required(o, "privateKeyPath"), optional(o, "slug"), optional(o, "burrowName"), optional(o, "name"));
+    }
+}
+/** Discovers and resolves the machine identities the bootstrap writes under `~/.burrow`. */
+export const Identities = {
+    /** The identity root: `$BURROW_HOME` if set, else `~/.burrow`. */
+    home() {
+        const env = process.env["BURROW_HOME"];
+        if (env !== undefined && env.trim().length > 0)
+            return env;
+        return join(homedir(), ".burrow");
+    },
+    /**
+     * Every identity under `<home>/burrows/<slug>/identity.json`, sorted by label then machine id.
+     * Directories without a readable, well-formed identity.json are skipped.
+     */
+    discover(home = Identities.home()) {
+        const burrows = join(home, "burrows");
+        if (!isDirectory(burrows))
+            return [];
+        let entries;
+        try {
+            entries = readdirSync(burrows);
+        }
+        catch {
+            return [];
+        }
+        const found = [];
+        for (const entry of entries) {
+            const dir = join(burrows, entry);
+            if (!isDirectory(dir))
+                continue;
+            const file = join(dir, "identity.json");
+            if (!existsSync(file))
+                continue;
+            try {
+                found.push(MachineIdentity.fromJson(JSON.parse(readFileSync(file, "utf8"))));
+            }
+            catch {
+                // A half-written or foreign file is not this host's identity; skip it rather than fail discovery.
+            }
+        }
+        // Ordinal, not locale-aware: the order has to be the same on every host that reads the same identities.
+        return found.sort((a, b) => ordinal(a.label.toLowerCase(), b.label.toLowerCase()) || ordinal(a.machineId, b.machineId));
+    },
+    /**
+     * Resolve the identity a client should act as. A single identity on file resolves automatically; with
+     * several, `selector` (a burrow name, slug, machine id, or URL) must disambiguate.
+     */
+    resolve(selector, home = Identities.home()) {
+        const ids = Identities.discover(home);
+        if (ids.length === 0) {
+            throw new BurrowIdentityException(`no Burrow identities under ${join(home, "burrows")}. Bootstrap this machine into a Burrow ` +
+                "first (its Machines page, Add machine).");
+        }
+        if (selector === undefined || selector === null || selector.trim().length === 0) {
+            const only = ids[0];
+            if (ids.length === 1 && only !== undefined)
+                return only;
+            throw new BurrowIdentityException(`this machine holds ${ids.length} Burrow identities; select one by name, slug, or machine id. ` +
+                `Known: ${ids.map((i) => i.label).join(", ")}`);
+        }
+        const matched = ids.filter((i) => i.matches(selector));
+        const first = matched[0];
+        if (matched.length === 1 && first !== undefined)
+            return first;
+        if (matched.length === 0) {
+            throw new BurrowIdentityException(`no Burrow identity matches "${selector}". Known: ${ids.map((i) => i.label).join(", ")}`);
+        }
+        throw new BurrowIdentityException(`"${selector}" matches more than one identity; select by machine id.`);
+    },
+    /**
+     * Resolve `target` to an identity for `Burrow`: null/undefined → the single identity (`resolve`); a
+     * filesystem path (a burrow directory or an identity.json) → load it directly; anything else → a selector
+     * (`resolve`). A URL (contains `://`) is always treated as a selector, never a path.
+     */
+    select(target, home = Identities.home()) {
+        if (target === undefined || target === null || target.trim().length === 0) {
+            return Identities.resolve(null, home);
+        }
+        if (!target.includes("://") && looksLikePath(target))
+            return loadFromPath(expandUser(target));
+        return Identities.resolve(target, home);
+    },
+};
+/** Parse an Ed25519 private key from a PKCS#8 PEM string (what `openssl genpkey -algorithm ed25519` writes). */
+export function parseEd25519PrivateKey(pem, source) {
+    const der = pemBody(pem);
+    if (der === null)
+        throw new BurrowIdentityException(`no PEM private-key block in ${source}`);
+    let key;
+    try {
+        // DER + pkcs8 explicitly, so a SEC1 or PKCS#1 body fails here rather than being silently accepted.
+        key = createPrivateKey({ key: der, format: "der", type: "pkcs8" });
+    }
+    catch (e) {
+        throw new BurrowIdentityException(`parsing Ed25519 private key in ${source}: ${messageOf(e)}`, { cause: e });
+    }
+    if (key.asymmetricKeyType !== "ed25519") {
+        throw new BurrowIdentityException(`parsing Ed25519 private key in ${source}: key is ${key.asymmetricKeyType ?? "of an unknown type"}, not Ed25519`);
+    }
+    return key;
+}
+/** Strip the PEM armor and base64-decode the body. Null when there is no PEM block. */
+function pemBody(pem) {
+    const begin = pem.indexOf("-----BEGIN");
+    if (begin < 0)
+        return null;
+    const afterBeginLine = pem.indexOf("\n", begin);
+    if (afterBeginLine < 0)
+        return null;
+    const end = pem.indexOf("-----END", afterBeginLine + 1);
+    if (end < 0)
+        return null;
+    const base64 = pem.slice(afterBeginLine + 1, end).replace(/\s/g, "");
+    try {
+        return Buffer.from(base64, "base64");
+    }
+    catch {
+        return null;
+    }
+}
+/** The host[:port] of a URL, for a display-only label fallback. */
+function hostOf(url) {
+    let s = url;
+    const scheme = s.indexOf("://");
+    if (scheme >= 0)
+        s = s.slice(scheme + 3);
+    const slash = s.indexOf("/");
+    if (slash >= 0)
+        s = s.slice(0, slash);
+    return s;
+}
+function looksLikePath(s) {
+    if (s.startsWith("/") || s.startsWith("~") || s.startsWith("./") || s.startsWith("../"))
+        return true;
+    if (s.endsWith(".json"))
+        return true;
+    if (isAbsolute(s))
+        return true;
+    try {
+        return existsSync(s);
+    }
+    catch {
+        return false;
+    }
+}
+function expandUser(s) {
+    if (!s.startsWith("~"))
+        return s;
+    return join(homedir(), s.slice(1).replace(/^\//, ""));
+}
+function loadFromPath(path) {
+    const file = isDirectory(path) ? join(path, "identity.json") : path;
+    if (!existsSync(file))
+        throw new BurrowIdentityException(`no identity file at ${file}`);
+    try {
+        return MachineIdentity.fromJson(JSON.parse(readFileSync(file, "utf8")));
+    }
+    catch (e) {
+        throw new BurrowIdentityException(`failed to parse identity file ${file}: ${messageOf(e)}`, {
+            cause: e,
+        });
+    }
+}
+function isDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function required(o, key) {
+    const v = o[key];
+    if (typeof v !== "string" || v.length === 0) {
+        throw new BurrowIdentityException(`identity is missing '${key}'`);
+    }
+    return v;
+}
+function optional(o, key) {
+    const v = o[key];
+    return typeof v === "string" ? v : "";
+}
+function blankTo(value, fallback) {
+    return value.trim().length > 0 ? value : fallback;
+}
+function eq(a, b) {
+    return a.toLowerCase() === b.toLowerCase();
+}
+function ordinal(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function messageOf(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+//# sourceMappingURL=Identity.js.map

package/dist/esm/Identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.js","sourceRoot":"","sources":["../../src/Identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAEf;IACA;IACA;IACA;IACA;IACA;IANX,YACW,SAAiB,EACjB,SAAiB,EACjB,cAAsB,EACtB,OAAe,EAAE,EACjB,aAAqB,EAAE,EACvB,OAAe,EAAE;QALjB,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QACtB,SAAI,GAAJ,IAAI,CAAa;QACjB,eAAU,GAAV,UAAU,CAAa;QACvB,SAAI,GAAJ,IAAI,CAAa;IACzB,CAAC;IAEJ,yEAAyE;IACzE,IAAI,KAAK;QACP,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAClG,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,SAAS;QACX,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,QAAgB;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,CACL,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;YACtB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YAChB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAClB,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,cAAc;QACZ,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAC7D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,gBAAgB;IAChB,MAAM,CAAC,QAAQ,CAAC,GAAY;QAC1B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,OAAO,IAAI,eAAe,CACxB,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,EACxB,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,EACxB,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAC7B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EACnB,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,EACzB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CACpB,CAAC;IACJ,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kEAAkE;IAClE,IAAI;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,OAAe,UAAU,CAAC,IAAI,EAAE;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,kGAAkG;YACpG,CAAC;QACH,CAAC;QACD,wGAAwG;QACxG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1H,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAwB,EAAE,OAAe,UAAU,CAAC,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,8BAA8B,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,yCAAyC;gBAC1F,yCAAyC,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,GAAG,CAAC,MAAM,+DAA+D;gBAC7F,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,+BAA+B,QAAQ,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,IAAI,QAAQ,yDAAyD,CACtE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAsB,EAAE,OAAe,UAAU,CAAC,IAAI,EAAE;QAC7D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC;AAEF,gHAAgH;AAChH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,mGAAmG;QACnG,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,MAAM,YAAY,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,eAAe,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,cAAc,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1F,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,QAAgB;IAC9C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS;IAC9B,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}